METHOD FOR DETECTING ANOMALOUS STATES OF A CONTROL OBJECT IN INFORMATION SYSTEMS BASED ON THE ANALYSIS OF TEMPORAL DATA AND KNOWLEDGE

(1)

[19] Timinsky, A. G. (2016). The conceptual model of bi-adaptive control system of project-oriented enterprise. Scientific enquiry in the contemporary world: theoretical basiсs and innovative approach. San Francisco, 289–292.

[20] Timinsky, A. G. (2017). Models of mutual impact of project subsystems and operating subsystems of project-oriented enterprises. Management of Development of Complex Systems, 29, 110–115.

METHOD FOR DETECTING ANOMALOUS STATES OF A CONTROL OBJECT IN INFORMATION SYSTEMS BASED ON THE ANALYSIS OF TEMPORAL DATA AND

KNOWLEDGE

Oksana Chala

Department of Information Control Systems Kharkiv National University of Radio Electronics

16 Nauka ave., Kharkiv, Ukraine, 61166 [email protected] Abstract

The problem of finding the anomalous states of the control object in the management information system under conditions of uncertainty caused by the incompleteness of knowledge about this object is considered. The method of classifying the current state of the control object in real time, allowing to identify the current anomalous state. The method uses temporal data and knowledge. Data is represented by sequences of events with timestamps. Knowledge is represented as weighted temporal rules and constraints. The method includes the following key phases: the formation of sequences of logical facts; selection of temporal rules and constraints;

classification based on a comparison of rules and constraints. Logical facts are represented as predicates on event attributes and reflect the state of the control object. Logical rules define valid sequences of logical facts. Performing a classification by successive comparisons of constraints and weights of the rules makes it possible to more effectively identify the anomalous state since the comparison of the constraints reduces the subset of facts comparing to the current state. The method creates conditions for improv- ing management efficiency in the context of incomplete information on the state of a complex object by using logical inference in knowledge bases for anomalous states of such control objects.

Keywords: anomalies, temporal rule, temporal knowledge base, management information system, event attributes.

DOI: 10.21303/2461-4262.2018.00787 © Oksana Chala

1. Introduction

The information management system is a human-machine system that designed to solve the tasks of managing the production and business activities of an enterprise based on automated collection, transmission and processing of information about the activities of this enterprise [1].

The tasks of enterprise management are implemented through a sequence of actions that allows to achieve planned results in terms of the impact of both internal and external environment of the enterprise [2, 3].

In practice, these tasks are performed under conditions of uncertainty at the level of the control object as a whole or of its individual components. Uncertainty of the second type is caused by incomplete information about the values of individual parameters of the control object. The uncertainty of the first type reflects the incompleteness of information about the control object in general.

In solving problems of control under conditions of the uncertainty of the second type, a priori knowledge of the subject area and traditional, usually deterministic mathematical models of the control object are used [4].

When solving management problems under conditions of the uncertainty of the second type, it is relevant to use an expert knowledge base reflecting the experience of the company’s personnel [4]. This knowledge base formed or through experts’ interrogation [5], or by monitoring the opera-

(2)

tion of the enterprise. The first approach is quite time-consuming, which does not allow constantly expanding the knowledge base during solving problems of real-time management. The second approach implements the paradigm of automated knowledge creation and use [6, 7]. Therefore, it can be used to support real-time management tasks [8].

Each of the management tasks is divided into subtasks of evaluating the current state of the enterprise as an object of management and the development of management actions that allow get- ting target results from the current state. These subtasks are usually solved sequentially, as knowledge about the current state is required to develop management actions. The subtask of evaluating the current state in case of incomplete knowledge of the object of management provides for the classification of this state. Classification of the state of the control object allows to simplify management decisions based on the choice of control actions from the set of permissible for a given class.

Hence, the identification of abnormal states of the control object allows to narrow down the set of permissible management decisions and thereby increase the efficiency of enterprise management.

Thus, the problem of finding the abnormal states of the control object in the management information systems under conditions of uncertainty caused by the incomplete knowledge about this object is relevant.

2. Literature review

The knowledge base, designed to support the solution of management tasks in the information management system under uncertainty, should take into account the multivariance of the behavior of the control object. For a single description of several alternative behaviors, a knowledge representation based on the Markov Logic Networks is used [9, 10]. The logical component of this representation defines the possible states of the control object and the dependencies between these states. These dependencies are represented by logical formulas and reflect the allowable sequences of control actions leading to the transition between the states of the control object. The probabilistic component of knowledge representation is given by the weights of the specified logical dependencies.

In case incomplete information about the state of the control object, these dependencies describe the permissible sequences of these states in time. Therefore, they are represented in the form of temporal rules. Such rules reflect both explicit and implicit dependencies between subject area [11]. With building these rules, temporal data is used in the form of event logs [12]. The method of temporal rules formation is presented in [13]. The method for calculating the weights of the rules is presented in the paper [14]. The method of using temporal rules to decision support system is suggested in the paper [15]. The current abnormal state is used as the initial data for this method, but the issues of detecting this abnormal state are not considered in this paper.

Existing approaches to finding anomalies in temporal data [16] are primarily aimed at processing data streams from sensors and various electronic devices. Therefore, they allow to provide support for management at the level of uncertainty of information regarding specific parameters of the control object. For solving this problem, it is necessary to consider not only temporal data but also temporal rules that determine the set of valid states of the control object.

The purpose of this article is development of a method for abnormal states detecting of a control object based on the temporal data and knowledge analysis in the context of incomplete information about the state of this object.

3. Method for detecting abnormal states of the control object

The developed method is designed to solve the problem of the control object’s current state evaluating. Formally, this task is defined as follows.

Let:– a type of dependencies R(s, u) between management impact u and the corresponding state s of the control object;

– a sequence of control impacts D_u; – a state sequence S the control object.

(3)

It is necessary to determine whether the current state s' is standard: s' S ,∈ ^Std characteris- tic of the standard behavior of the control object, or abnormal s' S∈ ^Abnormal, caused by unforeseen external influences:

Let

u 1 j Du

D = u ,...,u ,...,u ,

1 j S

S= s ,...,s ,...,s ,

j j

R(s,u) : ju∀ →s ,

Std Abnormal Std Abnormal

S S= ∪S , S ∩S = ∅, then find

s^j∈S^Std∨ ∈s^j S^Abnormal. (1) The initial data on the state of the control object are presented in the log L as events

( ) { }

^k

e a , which have a set of attributes

{ }

^{a .}^k Attributes contain information about the type of event, the action performed u_j, the values of the properties of the artifacts that which are mem- bers the control object.

The event also has a temporal attribute that contains the event’s execution time. Then, the achievement of the state s_j of the control object as a result of the controlling action u will be represented by a logical fact ft_j on the event attributes:

^u^j^→^{ft ,ft}^j ^j⁼^{Q a}

( ) { }

^k^j ^,⁽²⁾

where Q – predicate on the set of event attributes.

The behavior of the control object is represented in the log L as a set of events ordered in time π = e ,...,e ,... .1 j In the case of repeated implementation of the management cycle, such sets of events are recorded repeatedly: L= π1,...,πL . Then each sequence of events π_i in the log corresponds to a sequence S_i of states of the control object, represented as a sequence of logical facts ft_j:

π →ⁱ S ,Sⁱ ⁱ= ft ,...,ft^i,1 ^{i, S}ⁱ . (3) Expression (3) shows that it is possible to compare the states of the control object represented by different sequences of events π_i. Comparison is performed basing on attribute values a^kj

comparing for each pair of events.

Based on this sequence of facts, the temporal rules proposed by the authors are formed:

j m

ft KvantifierOperatorft [14, 15]. The quantifier determines the area of application of the rule regarding the sequences of states S_i of the control object. The developed rules use quantifiers E(Ex- ists) and A(All). The first quantifier determines the area of the rules for one sequence S_i. The second quantifier sets the truth of the rule for all states from the set S. Therefore, rules with quantifier A act as constraints in a temporal knowledge base.

Temporal operators define type relationships NeXt, Future, Until between the considered facts. The NeXt operator rule defines the relationship between a pair of sequential actions (or a pair of consecutive states). The rule with the NeXt operator defines the connection for a pair of actions (or states) between which intermediate actions are performed. The third rule determines the possibility of performing actions (transition to new states) depending on the current state of the control object.

The considered rules have a weight that corresponds to the probability of their realization on a given input set of temporal data [14].

(4)

The general idea of the proposed method is based on the use of the properties of the temporal rules of the types NeXt, Future. Type rule Until focused on the use of a subset of attributes, thus this method is not used.

The method includes the following steps.

Stage 1. Formation of sequences of logical facts

i i,1 i, j 1 i, j

S' = ft ,...,ft ₋ ,ft' , including current state ft' .i, j

The result of this step is the set of all possible sequences

{ }

^{S' ,}ⁱ that lead to the state represented by the fact ft' .i, j Each S'i corresponds to one sequence of events π_i. The length S'i de- pends on the number of facts fti, j 1₋,fti, j 1₋,... , which immediately precede the fact ft' .i, j

Stage 2. Formation of a set of temporal rules

{ }

^Rl'ⁱ of the types NeXt and Future for

{ }

^{S' .}ⁱ

The result of this stage is a set of temporal rules and constraints that describe all the avail- able ways to achieve the state S' .i

Stage 3. The formation of alternative sequences of facts

{ }

^S^l with the following properties:

S^l = ft ,...,ft^l,m ^l,M , 1 m J ft≤ < l,M≠ft' ,i, J ∀mftl,m =ft .i, j (4) According to expression (4), such sequences of facts of length from 1 to M are selected that correspond to a fragment of the sequence S' ,i directly preceding fact ft' .i, j This means that we consider the inseparable sequences of states of the control object, which immediately precede the current state represented by the fact ft' .i, j However, instead of this fact, alternative states are pres- ent in the selected sequences.

Stage 4. Rule set formation

{ }

Rl M for sequence

{ }

Sl M for each alternative state ft .l,M

Result set contains constraints.

Stage 5. Comparison of constraints for sets

{ }

Rl M and

{ }

^{Rl' .}ⁱ In the event that all the facts ftl,M contain more constraints than fact ft'i, j, that fact ft'i, j reflects the abnormal state of the control object and the method ends. Otherwise, a subset of facts Ft' is selected, in which the constraints match with the constraints of the fact ft'i, j.

Stage 6. Removing constraints. At this stage of the sets

{ }

Rl M and sets

{ }

^Rl'ⁱ general rules are deleted according to conditions:

∀m Rl

{ }

m→

{ }

Rl m\ ft AOperatorft ,l n (5)

{ } { }

^Rl'ⁱ → Rl' \ ft AOperatorft ,ⁱ ^l ⁿ (6) where A – quantifier All.

The result of this stage are subsets of specific rules

{ }

Rl ,m

{ }

^Rl'ⁱ for each alternative fact ft'i, J or ftl,M∈Ft'.

Stage 7. The calculation of the total potential for each alternative fact Φ(ft' )i, J or

l,M l,M

(ft ) ft Ft'.

Φ ∈ The potential is calculated as the sum of the weights of the temporal rules. The use of potential is due to the fact that temporal rules are based on the apparatus of Markov Logic Networks. Accordingly, the weights of the rules correspond to the probability of their implementation on the existing set of source data.

Stage 8. The classification of this state by the nearest neighbor method.

Potential fact sets Φ(ft' )i, J and

{

^Φ^{(ft )}^l,M

}

are used as metrics. Facts are ordered by the value of their potential. The potential of the fact ft'i, J is compared with the potential of the facts

{ }

^ft^l,M ^.

The condition of the state of the control object represented by the fact ft' ,i, J has the form:

∀Φ(ft ) (ft )^l,M Φ ^l,M − Φ(ft' )^{i, J} > ε. (7)

(5)

According to (7), if the potential difference of two facts surpass a predetermined threshold ε that fact ft'i, J is abnormal. Otherwise, the state ft'i, J belongs to the same class with the standard state ft .l,M

The result of this method is the abnormal or standard class of the current state represented as the fact ft' .i, J

4. Experiment

The goal of the experiment is testing the possibility of classifying the current state of the control object under conditions of uncertainty. Uncertainty is expressed in the absence of com- plete information about the characteristics of the current state of the control object. For example, as a result of an external impact, an object passed into a state that was not incorporated in its model. In this case, information about this state is incomplete. The initial data of the method are given in Table 1.

Table 1

The initial data of the method

Name Data

Initial temporal data áe_1,1, e_1,2, e_1,3, e_1,4, e_1,5, e_1,6, e_1,7, e_1,8ñ, áe_3,1, e_3,2, e_3,3, e_3,4, e_3,5, e_3,6, e_3,7, e_3,8ñ, áe_4,1, e_4,2, e_4,9, e_4,7, e_4,8ñ, áe_5,1, e_5,2, e_5,9, e_5,7, e_5,8ñ, áe_2,1, e_2,2, e_2,3, e_2,4, e_2,5, e_2,6, e_2,7, e_2,8ñ, áe_6,1, e_6,2, e_6,9, e_6,10, …ñ

Last event e_6,10

Constraints ft AXft ,1 2 ft AXft ,₇ ₈ ft AFft ,₁ ₇ ft AFft ,₁ ₈ ft AFft ,₂ ₇ ft AFft₂ ₈

Type rules NeXt (ft EXft 0,9),² ³ (ft EXft 2,7027),₂ ₉ (ft EXft 0,9),₃ ₄ (ft EXft 0,9),₄ ₅ (ft EXft 0,9),₅ ₆

6 7

(ft EXft 0,9), (ft EXft 2,7027)9 7

Type rules Future

2 4

(ft EFft 0,0857), (ft EFft 0,04286),₂ ₅ (ft EFft 0,01429),₂ ₆ (ft EFft 0,0857),₃ ₅

3 6

(ft EFe 0,04286), (ft EFft 0,01429),₃ ₇ (ft EFft 0,0857),₄ ₆ (ft EFft 0,04286),₄ ₇

5 7

(ft EFft 0,0857)

Threshold 1.0

Initial information includes temporal data and temporal rules. The data describes the behavior of the control object. The initial temporal data contains 6 sequences of events, which indicates that the management cycle has been repeatedly executed. The last (sixth) sequence contains information about the object in the current management cycle. The final event e_6,10reflects the current state s₁₀ of the control object. It is required to determine whether this condition is abnormal.

For the method’s functioning, knowledge is used represented in the form of temporal rules.

Among these rules, subsets of constraints, rules of type NeXt и Future. The subset of constraints includes rules with quantifier A. This means that these rules are executed both when abnormal states and typical states are reached. Therefore, restrictions are not used when classifying the cur- rent state of the control object. NeXt type rules associate the successive states of the control object.

Rules of the Future type associate states between which there may be other intermediate states.

Since the facts included in the rules take into account information about the actions that are being carried out, these rules associate not only states but also control actions. Note that the double index is not specified for the rules due to the use of quantifiers.

In accordance with the initial data, a classification was made for the current state recorded in the log as the last event e_6,10.The results of the method operation are presented in Table 2.

(6)

Table 2

The results of the method operation States

Stage results Classified state s₁₀ Set of typical states S^Std

The resulting facts

ft10

{

^{ft ,ft}^4,7 ^5,7

}

Sequences of facts

9 10

ft ,ft' , ft ,ft ,ft' ,₂ ₉ ₁₀ ft ,ft ,ft ,ft'₁ ₂ ₉ ₁₀ ft ,ft ,₉ ₇ ft ,ft ,ft ,₂ ₉ ₇ ft ,ft ,ft ,ft₁ ₂ ₉ ₇ Constraints

1 2

ft AXft ft AXft ,₁ ₂ ft AFft₁ ₇

Differences in constraints ft AFft1 7

Rules

2 9

(ft EXft 2,7027) (ft EXft 2,7027),₂ ₉ (ft EXft 2,7027)₉ ₇

Total potential 2,7027 5,4054

Constraints classification result Abnormal state

Rules classification result Abnormal state

During of implementing of this method, a check of the abnormal state s₁₀ was carried out twice: by constraints and by the rules.

The results of the check on the constraints show that for this state the constraint is not executed ft AFft .1 7 The constraint has weight ∞, which certainly exceeds the threshold ε, so state s₁₀ not standard and refers to abnormal. However, an additional comparison was made of the total potential of the rules, which also confirmed the non-standard character of this state.

5. Results and Discussion

The result of the work is a method for detecting an abnormal state, focused on the usage of temporal data and rules that define the behavior of a control object in real time.

The resulting evaluate of the current state of the method allows real-time detection of devi- ations in the behavior of an object from a standard trajectory and thus ensures that it is possible to make management decisions in time for the target state to be reached.

The difference of the proposed method is in the usage of knowledge in the form of temporal rules instead of initial temporal data. The potential of these rules reflects the likelihood of their execution on all sequences of events in the source data. Therefore, the classification of an indefinite current state is carried out on the basis of a probabilistic indicator, which makes it possible to evaluate the typical or non-standard state on the whole set of initial data.

The advantage of the method is in the ability of detecting anomalies both on the basis of restrictions and using rules. This makes it possible to increase the classification efficiency by selecting a set of standard states, the constraints of which correspond to the constraints of the current state and the subsequent detection of anomalies by comparing the potentials of the remaining rules.

The disadvantage of the method is that the rules and restrictions used significantly depend on the quality of the initial temporal data. Errors and noise in the source data may lead to the in- correct classification.

The developed method is intended for use in the management cycle under conditions of uncertainty using the temporal knowledge base by successively solving the problems of analyzing and supporting management decision making.

6. Conclusions

The problem of the control object’s current state evaluating in information and management systems under conditions of uncertainty caused by unforeseen external influences is considered.

(7)

The expediency of classifying the current state of the control object is based on the fact that the required sequence of management actions is determined by its current state. In the conditions of incomplete information about this state, it must be classified in order to ensure the possibility of choosing management actions for a given class of states.

A method for detecting abnormal states of the control object based on the analysis of temporal data describing this behavior is proposed. The method includes the steps of forming sequences of logical facts describing possible behaviors of the control object, selecting temporal constraints and rules defining this behavior, as well as classifying the current state of the control object based on the obtained restrictions and rules.

The proposed method has the following differences from traditional approaches to the search for anomalies.

First, the temporal rules are used, which generalize the behavior of the control object over the entire range of initial sequences of events. This allows to perform a comparison on the entire set of source data, and not only for its individual subsets, as in traditional methods.

Secondly, the method allows excluding from consideration those typical states of the control object that have different temporal constraints with the current state. This makes it possible to reduce the dimension of the problem and, accordingly, to increase the efficiency of anomalies detection.

In the practical aspect, the developed method creates conditions for increasing the efficiency of managing complex objects and processes in the context of incomplete information about the current state based on the classification of this state. If the current state is typical, then the traditional deterministic model of the control object is used. If the condition is abnormal, then further management is performed using probabilistic inference in the temporal knowledge base. The result of the output is a set of possible ways to reach the target state with an indication of the likelihood of each of these paths. The choice of the most rational path is carried out taking into account the specified values of the probabilities.

References

[1] Alcamí, R. L., Carañana, C. D. (2012). Introduction to Management Information Systems. Uni- versitat Jaume I, 39.

[2] Sljivic, S., Skorup, S., Vukadinovic, P. (2015). Management control in modern organizations.

International Review, 3-4, 39–49. doi: https://doi.org/10.5937/intrev1504039s

[3] Dechow, N., Granlund, M., Mouritsen, J. (2006). Management Control of the Complex Orga- nization: Relationships between Management Accounting and Information Technology. Handbooks of Man- agement Accounting Research, 625–640. doi: https://doi.org/10.1016/s1751-3243(06)02007-4

[4] Bubnicki, Z. (2005). Modern control theory. Berlin: Springer, 423. doi: https://doi.org/10.1007/

3-540-28087-1

[5] Kendal, S. L., Creen, M. (2007). An introduction to knowledge engineering. London: Springer, 290. doi: https://doi.org/10.1007/978-1-84628-667-4

[6] Nakashole, N., Weikum, G. (2012). Real-time Population of Knowledge Bases: Opportunities and Challenges. Proceedings of the Joint Workshop on Automatic Knowledge Base Construction and Web- scale Knowledge Extraction (AKBC-WEKEX) AKBC Workshop, 41–45.

[7] Kalynychenko, O., Chalyi, S., Bodyanskiy, Y., Golian, V., Golian, N. (2013). Implementation of search mechanism for implicit dependences in process mining. 2013 IEEE 7th International Conference on Intelligent Data Acquisition and Advanced Computing Systems (IDAACS). doi: https://doi.org/10.1109/

idaacs.2013.6662657

[8] Galárraga, L., Heitz, G., Murphy, K., Suchanek, F. M. (2014). Canonicalizing Open Knowledge Bases. Proceedings of the 23rd ACM International Conference on Conference on Information and Knowledge Management – CIKM ’14. doi: https://doi.org/10.1145/2661829.2662073

[9] Richardson, M., Domingos, P. (2006). Markov logic networks. Machine Learning, 62 (1-2), 107–136. doi: https://doi.org/10.1007/s10994-006-5833-1

[10] Singla, P., Domingos, P. (2006). Entity Resolution with Markov Logic. Sixth International Con- ference on Data Mining (ICDM’06). doi: https://doi.org/10.1109/icdm.2006.65

(8)

[11] Kalynychenko, O., Chalyi, S., Bodyanskiy, Y., Golian, V., Golian, N. (2013). Implementation of search mechanism for implicit dependences in process mining. 2013 IEEE 7th International Conference on Intelligent Data Acquisition and Advanced Computing Systems (IDAACS). doi: https://doi.org/10.1109/

idaacs.2013.6662657

[12] Sergii, C., Ihor, L., Aleksandr, P., Ievgen, B. (2018). Causality-based model checking in business process management tasks. 2018 IEEE 9th International Conference on Dependable Systems, Services and Technologies (DESSERT). doi: https://doi.org/10.1109/dessert.2018.8409176

[13] Levykin, V., Chala, O. (2018). Method of automated construction and expansion of the knowledge base of the business process management system. EUREKA: Physics and Engineering, 4, 29–35.

doi: http://dx.doi.org/10.21303/2461-4262.2018.00676

[14] Levykin, V., Chala, O. (2018). Method of determining weights of temporal rules in markov logic network for building knowledge base in information control systems. EUREKA: Physics and Engineering, 5, 3–10. doi: http://dx.doi.org/10.21303/2461-4262.2018.00713

[15] Levykin, V., Chala, O. (2018). Development of a method for the probabilistic inference of sequences of a business process activities to support the business process management. Eastern-European Jour- nal of Enterprise Technologies, 5 (3 (95)), 16–24. doi: https://doi.org/10.15587/1729-4061.2018.142664

[16] Gupta, M., Gao, J., Aggarwal, C. C., Han, J. (2014). Outlier Detection for Temporal Data: A Sur- vey. IEEE Transactions on Knowledge and Data Engineering, 26 (9), 2250–2267. doi: https://doi.org/10.1109/

tkde.2013.184

METHOD OF CONSTRUCTING AN ATTRIBUTE

DESCRIPTION OF THE BUSINESS PROCESS "AS IS" IN THE PROCESS APPROACH TO ENTERPRISE MANAGEMENT

Serhii Chalyi

16 Nauka ave., Kharkiv, Ukraine, 61166 [email protected]

Ievgen Bogatov

16 Nauka ave., Kharkiv, Ukraine, 61166 [email protected] Abstract

The problem of constructing an attribute description of a business process with the automated formation of process models

“as is” using logs of information systems in which the tracks of individual processes are not identified is considered. It is shown that to solve this problem, it is advisable to distinguish the distinctive properties of individual business processes represented by the attributes of log events. A method for constructing an attribute description of a business process is proposed. The method is based on the comparison of combinations of attributes for intervals of events of a fixed length and the subsequent selection of subsets of attributes with the same values. The method includes the steps of forming the intervals of events, constructing combinations of attributes for specified intervals, as well as calculating and subsequently averaging the weights of combinations of attributes on these intervals. The result of the method is a weight-ordered set of event attributes and their values, which takes into account the attribute and temporal aspects of the business process. The method creates conditions for a more efficient transition from functional to process management based on splitting the log into processes using the resulting attribute description and subsequent prototyping of business process models “as is” by means of process mining.

Keywords: business processes, process management, process trace, event log, event attributes.